IDS and IPS with Snort 3

12

IP Reputation

The concept of reputation is used commonly in our daily lives. It is often used as a metric to evaluate an entity, be it a place, a person, a group or an organization, a school or a company, and so on. The reputation associated with a particular entity is made and/or adjusted based on past and ongoing experiences, whether good or bad. A good reputation will open doors to incredible opportunities, whereas a bad reputation will result in closed doors. IP reputation follows the same concept. The object with which we associate the reputation is an IP address.

In this chapter, we will look at the IP reputation inspector module in Snort 3. We will discuss the following topics:

• Background
• Configuration of the IP reputation inspector ...